ZoneAlarm Pro FREE for one day

Check Point Software Technologies Ltd the company behind ZoneAlarm security solutions is likely to offer its product ZoneAlarm Pro security package for free with one year’s subscription. This offer is available for only 24 hours beginning 6 AM PDT on November 18, 2008.
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

Rootkits: They’re sneaky, But are they a major threat?

"Frank Boldewin had seen a lot of malicious software in his time, but never anything like Rustock.C. Used to infect Windows PCs and turn them into unwitting spam servers, Rustock.C is a rootkit that installs itself on the Windows operating system and then uses a variety of sophisticated techniques that make it nearly impossible to detect or even analyze.
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

Microsoft’s Stance on Piracy Affects Us All

"As it stands today, Microsoft’s policy allows pirated copies to receive patches automatically through AutoUpdate, yet forbids them from downloading them directly from Microsoft’s Web site. Despite some tweaks to its policy, however, the company continues to make it difficult for users of pirated versions of its operating system to patch reliably.
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

OSX.Lamzev.A - An OS X malware

A new trojan for the OS X has been discovered. When the Trojan is executed, it creates the following file:
/Applications/ezmal
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

Firefox 3.0.4 fixes several security issues

Mozilla today released Firefox 3.04 which addresses many several security issues among other bug fixes and exhancements.
The update fixes the following critical issues:
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

Microsoft explains seven-year-old patch delay

"Microsoft Corp. late yesterday explained why it had been unable to patch a seven-year-old bug until recently, saying that it was only in the last year that it figured out how to fix the flaw without breaking most network-based applications.
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

Spam Drops After Internet Providers Disconnect a California Hosting Firm

"The servers are operated by McColo Corp., which these experts say has emerged as a major U.S. hosting service for international firms and syndicates that are involved in everything from the remote management of millions of compromised computers to the sale of counterfeit pharmaceuticals and designer goods, fake security products and child pornography via email.
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

VirusTrigger Analysis and Removal

VirusTrigger is a new entrant to the ever growing family of rogue security software products. A clone of the rouge Antivirus Lab, the software and their Website is very professional in design and uses a variety of aggressive scare messages about non-existent malware infections.

Definition of a Rogue Security software: A rogue security software belongs to a family of software products that call themselves as antivirus, antispyware or registry cleaners and often use deceptive or high pressure sales tactics and deliberate false positives to convince users into buying a license/subscription. They are often repackaged and renamed. They do not actually remove malware instead many of them add more malware of their own.

• VirusTrigger - Domain Information and Installation
• VirusTrigger - Associated Files and Folders
• VirusTrigger - Associated Registry keys and values
• VirusTrigger - Associated Domains
• VirusTrigger - Removal (How to remove WinDefender 2009)
• VirusTrigger - Rogue Gallery
• VirusTrigger - Video

VirusTrigger - Domain Information and Installation

This rogue anti-spyware currently installs from multiple domains like virtrigger.com, virus-trigger.com, systemtrigger.com, virus-triggers.com and virustrigger2009.com all living in a server belonging to viruslabs2009.com at IP 74.50.110.184, currently not listed in any blacklists. All the virustrigger domains except virus-trigger.com use china and singapore based privacy protection services to hide their names and country of origin. virus-trigger.com is registered to Valters Buss of Latvia by the registrar DotArai Co., Ltd.

The installation file is named vrt_setup.exe, 1.40 MB in size. It is identified in various names by about 7 out of 36 (19.44%) engines at VirusTotal. This file must be manually executed for the installation of the rogue anti-spyware.

Once installed by the user, it produces various scare messages, an unwary user might have great difficulty in ignoring.

When the user is tricked into clicking on one of the confirmation buttons, the VirusTrigger rogue loads the default Internet browser and opens its subscription page, once a desired subscription is selected the browser is re-directed to their payment processor segpay.com. This rogue was observed making periodical GET requests to a file named sync.php at the following domains: virtrigger.com, virus-trigger.com, systemtrigger.com, virus-triggers.com and virustrigger2009.com using the process VirusTriggerBin.exe.

VirusTrigger - Associated Files and Folders

• C:\Program Files\VirusTriggerBin\uninst.exe
• C:\Program Files\VirusTriggerBin\VirusTriggerBin.exe
• C:\Program Files\VirusTriggerBin
• C:\Documents and Settings\Shanmuga\Start Menu\Programs\VirusTrigger 2.1\VirusTrigger 2.1.lnk
• C:\Documents and Settings\Shanmuga\Start Menu\Programs\VirusTrigger 2.1
• C:\Documents and Settings\Shanmuga\Start Menu\VirusTrigger 2.1.lnk
• C:\Documents and Settings\Shanmuga\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusTrigger 2.1.lnk
• C:\WINDOWS\Prefetch\VIRUSTRIGGERBIN.EXE-0A907FE7.pf

VirusTrigger - Associated Registry keys and values

VirusTrigger - Associated Domains

• virtrigger.com
• virus-trigger.com
• systemtrigger.com
• virus-triggers.com
• virtriggersupport.com
• virustrigger2009.com
• segpay.com
• viruslabs2009.com

VirusTrigger - Removal (How to remove VirusTrigger)

The free versions of MalwareBytes’s Anti-Malware and SuperAntiSpyware appear to remove this rogue security software quite comfortably.

1. Dowonload and Install either MalwareBytes’s Anti-Malware or SuperAntiSpyware from the links above.
2. Boot in to Windows Safe mode.
3. Click to scan with your chosen software. Check mark all instances of the rogue antispyware and delete them.
4. Turn System Restore off and on.
5. If you haven’t done yet, download, install scan and clean the temporary files with CCleaner.

You should now be clean of this rogue.

If you still see symptoms associated with this rogue anti-spyware, please post your problem at one of the Recommended Online Forums for Malware Help.

VirusTrigger - Rogue Gallery

VirusTrigger - Video

Note: The above installation was tested on a fully patched Windows XP SP3 running updated versions of Internet Explorer 7 and Firefox 3. The content provided in this article is not warranted or guaranteed by Malware Help. Org. The content provided is intended for entertainment and/or educational purposes. I am not liable for any negative consequences that may result from implementing any information covered in this article. The above information is correct at the time of my testing, it might change with time and or under different testing conditions.

If you enjoyed this post, make sure you subscribe to my RSS feed!

SURBL anti-spam blacklist to be a paid service

"The operator team of the SURBL anti-spam blacklist have announced a far-reaching change to the usage policy. While the use of the project’s DNS server has been free so far, the list’s operators are now demanding a usage fee from service providers that offer spam filter services for more than 1,000 mailboxes or 250,000 emails per day.
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!

Anti-malware Testing Guidelines Published

"The Anti-Malware Testing Standards Organization has published a set of best practices and guiding principles for testing security software. Call it a much-needed first step.
Read more

If you enjoyed this post, make sure you subscribe to my RSS feed!